EUVD-2021-30020

Malicious code in bioql PyPI...

EUVD-2025-14295

Malicious code in bioql PyPI...

EUVD-2022-52127

Malicious code in bioql PyPI...

EUVD-2022-29052

Malicious code in bioql PyPI...

CVE-2025-27388

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2025-8853

Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user...

CVE-2025-8853 2100 Technology｜Official Document Management System - Authentication Bypass

Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user...

CVE-2025-8853

CVE-2025-8853 concerns the Official Document Management System by 2100 Technology, which has an authentication bypass vulnerability. An unauthenticated remote attacker can obtain a user’s connection token and use it to log in as that user, enabling full access. CVSS metrics indicate CRITICAL impa...

CVE-2025-54064 rucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfiles

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...

CVE-2025-49198

The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens...

CVE-2018-13878

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...

CVE-2025-46743

An authenticated user's token could be used by another source after the user had logged out prior to the token expiring...

CVE-2025-46743

An authenticated user's token could be used by another source after the user had logged out prior to the token expiring...

CVE-2025-46743 Cross-Site Request Forgery

An authenticated user's token could be used by another source after the user had logged out prior to the token expiring...

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...

CVE-2024-57433

macrozheng mall-tiny version 1.0.1 is vulnerable to Incorrect Access Control within the logout function. The root cause is that a user's session token remains valid and available after they have logged out, allowing the token to continue fetching information in a logged-in state. As a temporary w...

CVE-2025-0498 Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability

A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could allow a threat actor to steal a token and, impersonate another user...

CVE-2025-0498

CVE-2025-0498 affects Rockwell Automation FactoryTalk AssetCentre, versions prior to V15.00.001. The root cause is insecure storage of FactoryTalk Security user tokens, enabling a threat actor to steal a token and impersonate another user. Documents indicate a data exposure vulnerability with pot...

CVE-2024-56044

CVE-2024-56044 concerns a flaw in the WordPress plugin “VibeThemes WPLMS” (versions 1.9.9 and earlier) that allows an authentication bypass via an alternate path or channel. The documented impact is unauthenticated, total access, enabling bypass of login controls and control over the affected sit...

CVE-2024-56044 WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplmsplugin allows Authentication Bypass.This issue affects WPLMS: from n/a through = 1.9.9...